Published January 2026 · 12 min read

What is NIS2?

The Network and Information Security Directive 2 (NIS2) is the EU's updated cybersecurity framework, replacing the original 2016 NIS Directive. It came into effect on 18 October 2024, with member states required to transpose it into national law.

The short version: NIS2 significantly expands which businesses must meet cybersecurity requirements, introduces personal accountability for management, and mandates specific incident reporting timelines.

Does NIS2 apply to your business?

NIS2 uses a "size-cap rule"—if you're a medium-sized or large entity in a covered sector, you're likely in scope.

Size thresholds

*Some small businesses may still be in scope if they provide critical services (e.g., sole provider of an essential service in a region) or are in specific high-risk categories like trust service providers.

Sectors covered

NIS2 covers significantly more sectors than its predecessor:

The supply chain effect

Here's where NIS2 gets interesting for smaller businesses: even if you're not directly in scope, your customers might be.

What NIS2 requires: The four pillars

1. Risk management

Covered entities must implement "appropriate and proportionate" technical and organizational measures to manage cybersecurity risks. For email infrastructure, this includes:

• Access control — Multi-factor authentication (MFA) is essentially mandatory
• Encryption — Data must be encrypted in transit and at rest
• Network security — Firewalls, intrusion detection, segmentation
• Incident handling — Documented procedures for detecting and responding to incidents
• Business continuity — Backup and recovery procedures
• Supply chain security — Vendor risk assessment

2. Corporate accountability

This is a significant change from NIS1: management bodies are personally accountable for ensuring cybersecurity measures are implemented.

3. Incident reporting

NIS2 introduces strict, multi-stage reporting requirements for "significant incidents":

A "significant incident" is one that causes or could cause severe operational disruption, financial loss, or affects other entities.

4. Business continuity

Entities must have plans for maintaining operations during and after cybersecurity incidents:

• Backup management — Regular, tested backups with secure storage
• Disaster recovery — Documented procedures for system restoration
• Crisis management — Defined roles and communication procedures
• Testing — Regular testing of continuity plans

Email infrastructure under NIS2

Email is often a primary attack vector and a critical business system. NIS2's requirements have specific implications for how you manage email infrastructure.

Authentication requirements

NIS2 explicitly mentions "multi-factor authentication or continuous authentication solutions" as required measures. For email:

• MFA for email access — All email accounts should require MFA
• MFA for administrative access — Email system administration must use MFA
• API authentication — Email integrations should use secure authentication (API keys, OAuth)

Encryption requirements

NIS2 requires "voice, video, and text encryption" for communications. For email infrastructure:

• TLS for email transport — Mandatory encryption in transit
• Encryption at rest — Stored emails must be encrypted
• End-to-end encryption — Consider for sensitive communications

Access control

The principle of least privilege applies to email systems:

• Limit mailbox access — Only necessary personnel should access shared mailboxes
• Audit email access — Log and monitor who accesses what
• Third-party access — Carefully control what email automation tools can access

Supply chain considerations

Your email infrastructure vendors are part of your supply chain. Under NIS2, you should assess:

• Where is email data processed? — Jurisdiction matters for incident reporting
• What security certifications do vendors have? — SOC 2, ISO 27001, etc.
• How do vendors handle incidents? — Will they notify you within your reporting timeline?
• What access do vendors have? — Can they read your email content?

Penalties and enforcement

NIS2 significantly increases penalties compared to NIS1:

Beyond fines, enforcement powers include:

• Regular audits and security inspections
• Binding instructions to implement specific measures
• Temporary bans on individuals holding management positions
• Public disclosure of non-compliance

Implementation timeline

NIS2 became applicable on 18 October 2024, but national transposition varies:

• October 2024 — NIS2 in effect, NIS1 repealed
• Germany — Implementation act passed November 2025, effective December 2025
• Other member states — Varying timelines; some behind schedule

If you're in a covered sector, the time to prepare is now—not when your specific country finalizes transposition.

Practical steps for email infrastructure

Immediate actions

1. Enable MFA everywhere — Email accounts, admin panels, API access
2. Audit current access — Who can access what email data?
3. Review OAuth permissions — What third-party apps have email access?
4. Document your email flow — Where does email data go? Who processes it?

Medium-term improvements

1. Implement logging — Track email access and processing
2. Establish incident procedures — How will you detect and report email-related incidents?
3. Assess vendors — Request security documentation from email service providers
4. Review encryption — Ensure TLS is enforced, consider additional encryption

Strategic considerations

1. Minimize third-party access — Selective processing over full mailbox access
2. Consider jurisdiction — EU-hosted email infrastructure simplifies compliance
3. Plan for incidents — Your 24-hour reporting clock starts when you detect an issue
4. Train leadership — Management needs to understand email security risks

Sources and further reading

• NIS2 Directive — European Commission
• NIS2 Technical Implementation Guidance — ENISA
• NIS2 Directive FAQs — European Commission
• NIS2 Requirements Overview
• NIS2 Requirements: A Complete Guide — DataGuard

Questions about NIS2 and your email infrastructure? We're not lawyers, but we're happy to discuss the technical aspects. Get in touch.